Google PCA Practice Test 29 — 15 Questions

Question 1

A company is migrating a monolithic e-commerce application to Google Cloud. The application has been refactored into microservices. Most services are stateless and can run on Cloud Run. However, the checkout service requires maintaining session state across multiple requests, and the session data must be available globally for low latency. The application will be deployed in multiple regions to serve a global user base. Which approach should the company take?

Accepted Answer

Deploy the checkout service on Cloud Run in multiple regions, and use Memorystore (Redis) with replication as the session store. Option C is correct because Memorystore (Redis) with replication provides a globally accessible, low-latency session store that can be used by Cloud Run instances in multiple regions. Redis replication ensures data durability and high availability, while Cloud Run's stateless nature is complemented by externalizing session state to a managed caching layer. This architecture meets the requirement for global session data availability without coupling state to individual compute instances.

Answer

Run the checkout service on Compute Engine with regional managed instance groups and Cloud Filestore

Answer

Use Cloud Run with session affinity and in-memory caching within each instance

Answer

Deploy the checkout service on Google Kubernetes Engine using StatefulSets and regional persistent disks

Question 2

A company is migrating a stateful application to Google Cloud. The application requires persistent disks with low latency and high IOPS for database workloads. They plan to use Compute Engine instances with SSD persistent disks. However, the database performance is lower than expected. Which action should the company take to improve disk performance?

Accepted Answer

Use local SSDs with RAID 0 configuration for the database data.. Option C is correct because local SSDs provide the highest IOPS and lowest latency of any disk option on Compute Engine, and striping them with RAID 0 aggregates their performance. This directly addresses the need for high IOPS and low latency for database workloads, unlike persistent disks which have performance ceilings tied to disk size and instance limits.

Answer

Change the persistent disk type to standard persistent disk.

Answer

Increase the disk size to increase baseline IOPS.

Answer

Enable disk encryption to improve I/O throughput.

Question 3

A company is designing a hybrid network architecture connecting an on-premises data center to Google Cloud. They need high availability (99.99% SLA) and bandwidth up to 10 Gbps. They also need to use their existing MPLS circuits. Which THREE components should they include in the design? (Choose three.)

Accepted Answer

Two VLAN attachments to two different edge availability domains.. Option A is correct because VLAN attachments in Google Cloud are associated with edge availability domains (EADs), which represent physically independent failure domains within a zone. By attaching two VLAN attachments to two different EADs, the design ensures that a failure in one EAD does not affect the other, supporting the 99.99% SLA requirement. This is a key component of a highly available Dedicated Interconnect or Partner Interconnect setup.

Answer

Cloud CDN to cache content and reduce latency.

Answer

Cloud VPN tunnels with multiple gateways for failover.

Question 4

Your company runs a critical application on Compute Engine instances in us-central1. The application requires low latency between instances that are all in the same region. You notice that network latency between instances varies and sometimes spikes. You want to ensure consistent low-latency communication. You currently use external IP addresses for communication between instances. What should you do?

Accepted Answer

Use internal IP addresses instead of external IPs for inter-instance communication.. Using internal IP addresses (RFC 1918) for inter-instance communication avoids the overhead of NAT, external routing, and potential egress bottlenecks. Traffic stays within Google's internal network fabric, reducing latency variability and eliminating spikes caused by external internet path fluctuations.

Answer

Move instances to the same zone to reduce network hops.

Answer

Upgrade to larger machine types to improve network bandwidth.

Answer

Set up a Cloud VPN connection between instances.

Question 5

A company is deploying a web application on Google Kubernetes Engine. The application serves HTTP traffic and needs to scale based on CPU utilization. They also need to expose the application to the internet with a single global IP address. They create a Deployment with a HorizontalPodAutoscaler. However, the application is not receiving traffic from the internet. What should they do to expose the application correctly?

Accepted Answer

Create an Ingress resource with the GCE ingress controller.. The correct approach is to create an Ingress resource with the GCE ingress controller because it provides a single global IP address via an HTTP(S) load balancer, which is required for internet-facing traffic. The HorizontalPodAutoscaler scales the Deployment based on CPU utilization, but the application must be exposed through a Service (typically of type NodePort or ClusterIP) that the Ingress routes to. The GCE ingress controller automatically provisions a global HTTP(S) load balancer, satisfying the requirement for a single global IP address.

Answer

Create a Service of type NodePort and use a firewall rule to allow traffic.

Answer

Create a Service of type ClusterIP and a load balancer manually.

Answer

Define a Network Endpoint Group (NEG) and attach it to a backend service.

Question 6

Your company is using Cloud Storage to store sensitive customer data. The security team requires that all objects be encrypted with a customer-managed encryption key (CMEK) and that the key be automatically rotated every 90 days. You need to implement this without changing the application code. You have created a Cloud KMS key ring and a key with rotation period set to 90 days. What additional configuration is required?

Accepted Answer

Set the default encryption key of the Cloud Storage bucket to the Cloud KMS key.. Option D is correct because setting the default encryption key of the Cloud Storage bucket to the Cloud KMS key ensures that all objects written to the bucket are automatically encrypted with that CMEK, without requiring any application code changes. The Cloud KMS key's rotation period of 90 days is already configured, so the key will be rotated automatically, meeting the security team's requirement.

Answer

Set a bucket lifecycle rule to transition objects to a different storage class.

Answer

Create a custom customer-supplied encryption key (CSEK) and provide it in each request.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account.

Question 7

A company runs a batch processing workload on Compute Engine instances. The workload is triggered every hour and runs for about 10 minutes. They want to reduce costs. They currently use preemptible VMs, but they notice that sometimes the workload fails because VMs are preempted before completion. They need a cost-effective solution that ensures the workload completes reliably. What should they do?

Accepted Answer

Create a custom machine type with minimal resources and use a managed instance group with preemptible VMs, combined with a startup script that retries on failure.. Option D is correct because it combines the cost savings of preemptible VMs with reliability through a managed instance group (MIG) and a retry startup script. The MIG automatically recreates VMs if preempted, and the startup script ensures the batch workload restarts from where it left off or retries the entire job, guaranteeing completion at minimal cost.

Answer

Increase the machine size of the preemptible VMs to finish faster.

Answer

Provision a commitment-based discount for standard VMs.

Answer

Use standard (non-preemptible) VMs to avoid preemption.

Question 8

A company stores backup data in Cloud Storage. They observe high egress costs when clients download backups. Additionally, they must retain backups for 7 years for compliance. Which optimization should they implement first?

Accepted Answer

Enable requester pays on the bucket. High egress costs occur when clients download backups, and enabling requester pays shifts these costs to the clients. This directly addresses the cost issue without changing storage class or retention. Requester pays is the first optimization because it resolves the immediate cost problem while lifecycle rules or storage class changes address separate concerns like retention or storage cost.

Answer

Use lifecycle rules to transition to Archive after 30 days and delete after 7 years

Answer

Set up a Cloud CDN for backup downloads

Answer

Move the backup data to Archive storage class

Question 9

A startup deploys a microservices application on GKE. They need to ensure high availability of the services. Which two strategies should they implement? (Choose TWO.)

Accepted Answer

Use regional persistent disks for stateful components. Option B is correct because regional persistent disks provide synchronous replication across two zones within a region, ensuring that stateful workloads (e.g., databases) remain available even if an entire zone fails. This is critical for high availability of stateful components in a GKE cluster, as it prevents data loss and allows pods to be rescheduled in another zone with the same persistent volume.

Answer

Use horizontal pod autoscaling

Answer

Use node auto-repair

Answer

Use cluster autoscaler

Question 10

Refer to the exhibit. A Cloud Run service is experiencing high latency and returns 502 errors when traffic spikes. What should the team adjust first?

Accepted Answer

Decrease containerConcurrency to 10. The 502 errors and high latency during traffic spikes indicate that the Cloud Run service is overwhelmed by concurrent requests. Decreasing `containerConcurrency` to 10 limits the number of simultaneous requests each container instance can handle, which reduces the likelihood of request timeouts and 502 errors by forcing Cloud Run to scale out more instances sooner. This directly addresses the root cause—excessive concurrency per container—without incurring additional cost or requiring code changes.

Answer

Increase the maximum number of instances

Answer

Increase the CPU limit to 2000m

Answer

Increase the memory limit to 512Mi

Question 11

A company uses Cloud SQL for PostgreSQL for their transactional database. They need a disaster recovery solution that provides cross-region failover with a recovery point objective (RPO) of less than 1 minute. Which solution meets these requirements?

Accepted Answer

Create a cross-region read replica and promote it during failover. A cross-region read replica in Cloud SQL for PostgreSQL can be promoted to a standalone instance during a disaster, enabling failover to another region. The replica uses PostgreSQL's native streaming replication, which typically provides an RPO of less than 1 minute because changes are replicated asynchronously but with very low latency. This meets the stated RPO requirement without needing to redesign the application for global consistency.

Answer

Use Cloud Spanner for global strong consistency

Answer

Use a Cloud SQL for PostgreSQL instance with multiple zones

Answer

Take daily automated backups and restore in another region

Question 12

Refer to the exhibit. A Cloud Function processes files uploaded to Cloud Storage. It usually completes within 2 minutes, but recently it has been timing out after 540 seconds. What is the most likely cause?

Accepted Answer

A user uploaded a file larger than the maximum allowed size for the function (e.g., 6 GB), causing the processing time to exceed the 540s timeout. Option B is correct because Cloud Functions have a maximum execution timeout of 540 seconds (9 minutes). If a file larger than the function's memory and processing capacity is uploaded, the function may take longer than this hard limit to process it, resulting in a timeout. The exhibit indicates the function usually completes within 2 minutes, so a sudden spike to exactly 540 seconds strongly suggests the file size exceeded the function's ability to finish within the maximum allowed timeout.

Answer

The function's maximum timeout was set to 540 seconds, causing it to always take that long

Answer

The function's memory limit is too low, causing thrashing and slowdown

Answer

The function entered an infinite loop

Question 13

A financial institution stores sensitive customer data in Cloud Storage. They need to audit all data access and prevent unauthorized data exfiltration. They also require context-aware access controls based on user location and device. Which Google Cloud service should they configure?

Accepted Answer

VPC Service Controls with the perimeter set to the data layer. VPC Service Controls (option C) is correct because it creates a security perimeter around Google Cloud APIs, including Cloud Storage, to prevent unauthorized data exfiltration (e.g., copying data to an external project) while allowing context-aware access controls based on user location and device via Access Context Manager. This directly addresses the requirement for both audit (via Cloud Audit Logs integrated with the perimeter) and exfiltration prevention, which other services like DLP or Access Transparency alone cannot enforce.

Answer

Cloud Data Loss Prevention (DLP) for inspecting data

Answer

Cloud Audit Logs and Cloud Monitoring for alerts

Answer

Access Transparency logs for audit

Question 14

A company uses Cloud Armor to protect their HTTP load balancer. They need to block traffic from a specific set of IP addresses and also prevent SQL injection attacks. Which two configurations should they use? (Choose TWO.)

Accepted Answer

Security policies with IP deny rules. Option D is correct because Cloud Armor security policies allow you to create IP deny rules to block traffic from specific IP addresses or ranges at the edge of Google's network, before it reaches your load balancer. Option E is correct because Cloud Armor also provides preconfigured WAF rules, including SQL injection detection, which can be added to the same security policy to inspect HTTP/HTTPS requests and block malicious payloads.

Answer

IAM roles to restrict access

Answer

Firewall rules on the VM instances

Answer

Ingress rules on the VPC network

Question 15

A company uses Cloud Composer to manage Apache Airflow workflows. They want to optimize costs. Which practice is most effective?

Accepted Answer

Configure auto scaling for the Cloud Composer environment. Cloud Composer supports autoscaling for its workers, which dynamically adjusts the number of worker pods based on the Airflow task queue depth. This directly optimizes costs by scaling down during low-load periods and scaling up only when needed, avoiding over-provisioning.

Answer

Use preemptible VMs for Airflow schedulers

Answer

Replace Cloud Composer with Cloud Functions for all workflows

Answer

Use small machine types for all Composer components